Azure Storage Account without Secure transfer enabled misconfiguration detected in code

Azure Storage Account without Secure transfer enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_3
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	4a6a7642-06f0-4e51-aa79-a7c06afffdc5

Impact

Azure Storage Accounts provide the capability to store a variety of data types, including blobs, files, queues, tables, and disks. Ensuring the secure transport of this data is crucial to prevent potential eavesdropping and man-in-the-middle attacks.

This rule ensures that the 'supportsHttpsTrafficOnly' property for Azure Storage Accounts is set to 'true'. By setting this property to 'true', only HTTPS traffic is allowed to the storage service. Notably, since the API version 2019-04-01, the default value for 'supportsHttpsTrafficOnly' has been set to 'true'. However, it's important to verify this for Storage Accounts, especially those created before this API version.

HTTPS ensures that the data between the client and server is encrypted, adding a layer of security for data in transit.

How to Fix

Resources:

• azurerm_storage_account

Arguments:

• enable_https_traffic_only

Azure Resource Manager (ARM)

Resources:

• Microsoft.Storage/storageAccounts

Arguments:

• properties/supportsHttpsTrafficOnly [source,go]

---

resource "azurerm_storage_account" "example" { name = "examplestoracc" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location account_tier = "Standard" account_replication_type = "LRS"

• enable_https_traffic_only = true # Ensure only HTTPS traffic is allowed. }

---

{ "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2020-08-01-preview", "name": "mystorageaccount", "location": "westus", "properties": {

• "supportsHttpsTrafficOnly": true # Ensure the storage service allows HTTPS traffic only.

... other configurations ...

} }